From f00da773cf026b44fbeee3294abe18c44eeacb44 Mon Sep 17 00:00:00 2001
From: Adam Chrapkowski <adam.chrapkowski@sourcegraph.com>
Date: Fri, 30 Oct 2026 11:45:49 +0100
Subject: [PATCH] chore/ci: automate Java image dependency updates

Renovate currently misses the Maven, Gradle, and Coursier versions in the image setup script. Teach it to update those versions and group the image and CI Gradle updates in one PR.

These image updates require review rather than automerging. Temurin updates stay on Java 25, and image publication is unchanged.
---
 .github/renovate.json | 34 +++++++++++++++++++++++++++++++++-
 bin/docker-setup.sh   | 13 ++++++++++---
 2 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/.github/renovate.json b/.github/renovate.json
index 91989653d..0147caf85 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -4,5 +4,37 @@
     "config:recommended"
   ],
   "automerge": true,
-  "semanticCommits": false
+  "semanticCommits": "disabled",
+  "customManagers": [
+    {
+      "customType": "regex",
+      "managerFilePatterns": ["/^bin/docker-setup\\.sh$/"],
+      "matchStrings": [
+        "# renovate: datasource=(?<datasource>\\S+) depName=(?<depName>\\S+) versioning=(?<versioning>\\S+)\\n[A-Z_]+_VERSION=(?<currentValue>\\S+)"
+      ]
+    }
+  ],
+  "packageRules": [
+    {
+      "matchManagers": ["custom.regex"],
+      "automerge": false
+    },
+    {
+      "matchDatasources": ["github-releases"],
+      "matchPackageNames": ["coursier/coursier"],
+      "extractVersion": "^v(?<version>\\d+\\.\\d+\\.\\d+)$"
+    },
+    {
+      "matchDatasources": ["gradle-version"],
+      "matchPackageNames": ["gradle", "gradle/gradle"],
+      "groupName": "Gradle runtime",
+      "automerge": false
+    },
+    {
+      "matchManagers": ["dockerfile"],
+      "matchPackageNames": ["eclipse-temurin"],
+      "allowedVersions": "/^25(?:[.-]|$)/",
+      "automerge": false
+    }
+  ]
 }
diff --git a/bin/docker-setup.sh b/bin/docker-setup.sh
index b5707e7f3..7e100274c 100755
--- a/bin/docker-setup.sh
+++ b/bin/docker-setup.sh
@@ -1,16 +1,23 @@
 #!/usr/bin/env bash
 set -eux
+# renovate: datasource=github-releases depName=coursier/coursier versioning=semver
+COURSIER_VERSION=2.1.26
+# renovate: datasource=maven depName=org.apache.maven:apache-maven versioning=maven
+MAVEN_VERSION=3.9.16
+# renovate: datasource=gradle-version depName=gradle versioning=gradle
+GRADLE_VERSION=9.8.2
+
 # Use the upstream JVM launcher so the configured system trust store applies.
-curl -fLo /usr/local/bin/cs https://github.com/coursier/coursier/releases/download/v2.1.26/coursier
+curl -fLo /usr/local/bin/cs "https://github.com/coursier/coursier/releases/download/v${COURSIER_VERSION}/coursier"
 chmod +x /usr/local/bin/cs
 ln -sf /usr/local/bin/cs /usr/local/bin/coursier
 
-curl -fLo maven.zip https://archive.apache.org/dist/maven/maven-3/3.9.16/binaries/apache-maven-3.9.16-bin.zip
+curl -fLo maven.zip "https://archive.apache.org/dist/maven/maven-${MAVEN_VERSION%%.*}/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.zip"
 unzip -d /opt/maven maven.zip
 rm maven.zip
 mv /opt/maven/*/* /opt/maven
 
-curl -fLo gradle.zip https://services.gradle.org/distributions/gradle-9.8.2-bin.zip
+curl -fLo gradle.zip "https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip"
 unzip -d /opt/gradle gradle.zip 
 rm gradle.zip
 mv /opt/gradle/*/* /opt/gradle